wvWare wv EUVD-2026-103517

Exploitation requires a victim to open an attacker-supplied, malformed .doc file in AbiWord or any application that parses Word documents via wvWare wv (libwv) version 1.2.9 or earlier; the trigger is specifically an FKP structure with an oversized crun (run count) value processed by wvGetPAPX_FKP/wvGetCHPX_FKP. The vector is local (AV:L) and unauthenticated (PR:N) but gated by passive user interaction (UI:P) - the document must be opened. Limiting factors: no remote/network exploitation, no privilege gain, and impact is confined to an application crash (availability); the target must be built against a vulnerable wv version, so patched or non-wv document readers are unaffected.

This is a moderate-severity, low-urgency issue best characterized as a client-side denial-of-service rather than a high-priority remote threat. The provided CVSS 4.0 vector (AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H, score 6.8) correctly frames it as a local, low-complexity flaw requiring passive user interaction (opening a malicious file) with impact limited to availability (VA:H) - a crash - and explicitly no confidentiality or integrity impact (VC:N/VI:N). This availability-only scoring conflicts with the 'Information Disclosure' tag and CWE-125 framing: an out-of-bounds read can in principle leak adjacent stack memory, but the description only substantiates a crash ('crashing applications like AbiWord'), so treating this as a confirmed info-leak would overstate it - verify actual read-exposure with the VulnCheck advisory before claiming data disclosure. No EPSS score, KEV listing, or explicit exploit-code flag is present in the input, so there is no public exploit identified at time of analysis and no evidence of exploitation probability. Overall this is a genuine bug worth patching in software bundling wv/libwv, but it is not an emergency: exploitation yields a crash, not takeover, and depends on tricking a user into opening a crafted document locally.

An attacker emails or hosts a specially crafted Microsoft Word .doc file containing an inflated FKP crun (run count) value. When a victim opens the document in AbiWord or another application linked against wvWare wv ≤1.2.9, wvGetPAPX_FKP/wvGetCHPX_FKP reads kilobytes past the 512-byte stack buffer, crashing the application. A technical write-up pinpointing fkp.c exists, but no packaged exploit code is identified in the provided data.